Description
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.
Affected products
mozilla: firefox mobile
References3
- bugzilla.mozilla.org/show_bug.cgi?id=1837916 ExploitIssue Tracking
- bugzilla.mozilla.org/show_bug.cgi?id=1837916 ExploitIssue Tracking
- www.mozilla.org/security/advisories/mfsa2024-36/
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 24 · as of 5 November 2026
- CWE
- CWE-601
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.